WEIRD MACHINES IN PROGRAM METADATA: ATTACKS AND DEFENSES NOVEMBER - PowerPoint PPT Presentation

ANNUAL INDUSTRY WORKSHOP NOVEMBER 6-7, 2013 WEIRD MACHINES IN PROGRAM METADATA: ATTACKS AND DEFENSES NOVEMBER 2013 REBECCA “. bx ” SHAPIRO DARTMOUTH COLLEGE TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.ORG 1 UNIVERSITY OF ILLINOIS | DARTMOUTH COLLEGE | UC DAVIS | WASHINGTON STATE UNIVERSITY FUNDING SUPPORT PROVIDED BY DOE-OE AND DHS S&T

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013 TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G OUTLINE/CONTRIBUTIONS • Highlight metadata as a mostly undefended attack vector • Demonstrate metadata-driven computation environment – “Weird machine” – Runtime loader → machine – Program metadata → instructions • Discuss defenses 2

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013 TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G TRADITIONAL VIEW OF EXECUTABLES 3

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013 TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G OUR VIEW OF EXECUTABLES 4

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013 TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G ELF AND METADATA IN THE POWER GRID • ELF – one way to package code and data – E xecutable and L inking F ormat – Binary metadata/file format of Linux/Unix • (Windows uses PE; OSX uses Mach-O) • ELF in the power grid – Embedded Linux Program code • Kernel binary • Kernel modules • Executable binaries • Shared libraries 5

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013 TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G HOW TO LOAD/EXECUTE AN ELF 6 6

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013 TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G HOW TO LOAD/EXECUTE AN ELF Weird machines lurk here 7 7

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013 TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G ELF DYNAMIC RELOCATION METADATA • Intended behavior – Processed by RTLD (the runtime loader) – Instructs RTLD to write given value at given address • Unintended behavior – Can locate base address of randomized libraries – Can perform dynamic linking – Can perform arbitrary computation (WOOT 2013) 8

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013 TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G TAMING THE RTLD WEIRD MACHINE • Case study: ping in inetutils v1.8 • Goal: insert backdoor that drops root shell – Without changing code • Facts about ping: – Widely used networking tool – Runs setuid as root – Drops privilege during execution • See 29C3 Talk – “ The Care and Feeding of Weird Machines Found in Executable Metadata” • Available in both ELF and Mach-O flavors 9

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013 TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G TODAY’S DEFENSES ARE NOT SUFFICIENT • Input validation • Data execution protection (DEP) • Address space layout randomization (ASLR) • Code signing/integrity checking • Access control (RWX) • (where is the vulnerability?) Photoshopped by Kythera of Anevern 10

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013 TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G OUR DEFENSE APPROACH #1: ELFBAC • A more generic weird machine defense • Build/enforce intra-process access control • Limit the chunks of addresses that chunks of running code can access – e.g.: libraries should not touch application’s sensitive data • Enforce module-level control flow integrity – e.g: data should be encrypted before sent over network • ELFbac: Using the Loader Format for Intent-level Semantics and Fine- grained Protection. Dartmouth Computer Science Technical Report TR2013-727 11

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013 TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G OUR DEFENSE APPROACH #2: LANGSEC • Defending against parser-based weird machines • Input  data  “instructions” • Input should be designed as a formal language • Input structure should be well-defined • Should not require a Turing machine to validate/interpret input • Regular expressions can be reasoned about • Weird machines lurk in Turing-complete recognizers • Langsec.org (Bratus et al) 12

ANNUAL INDUSTRY WORKSHOP – NOVEMBER 6-7, 2013 TRUSTWORTHY CYBER INFRASTRUCTURE FOR THE POWER GRID | TCIPG.OR G DO YOU KNOW WHAT WEIRD MACHINES LURK IN YOUR DATA? 13 13